Spring Framework Algorithmic Denial of Service via SpEL Expressions

HIGH | JUNE 08, 2026 | CVE-2026-41850

Description

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.

Specifically, an application is vulnerable when the following condition is met:

The application accepts and evaluates untrusted or user-controlled SpEL expressions.

Affected Spring Products and Versions

Spring Framework:

7.0.0 - 7.0.7
6.2.0 - 6.2.18
6.1.0 - 6.1.27
5.3.48 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
7.0.8	OSS
7.0.7.1	Enterprise Support Only
6.2.19	OSS
6.2.18.1	Enterprise Support Only
6.1.28	Enterprise Support Only
5.3.49	Enterprise Support Only

Fixed versions of the Spring Expression Language track the number of operations performed during expression evaluation. To mitigate potential impact on legitimate applications, the new maxOperations limit (default: 10,000) can be customized. If exceeded, applications will throw a SpelEvaluationException (EL1085E). If necessary, developers can adjust this limit locally via SpelParserConfiguration or globally using the spring.expression.maxOperations JVM system property or Spring property. Care should be taken when increasing this value, as higher limits reduce the effectiveness of the mitigation against resource exhaustion.